We recommend that OJP work with the Louisiana Commission on Law Enforcement to ensure its FYs 2020, 2021, and 2022 Crime Victim State Certification Forms accurately reflect all activity and payments and take necessary steps to recover the excess awarded funds as appropriate.

Require the Maryland GOCPP to develop and implement adequate controls to ensure required grant-related records are retained in accordance with DOJ and state guidelines.

Require the Maryland GOCPP to strengthen its annual state certification reporting practices to improve reporting accuracy.

Require the Maryland GOCPP to develop and implement controls to ensure adequate oversight and improve the accuracy of performance reporting.

Work with the Maryland GOCPP to strengthen procedures for its secondary review of payments and implement enhanced accounting controls to help mitigate the risk of duplicate payments.

Remedy $80,550 in duplicate victim compensation payments.

Remedy $66,653 in unallowable questioned costs associated with victim compensation payments.

Remedy the $4,400 in unsupported questioned cost associated with a victim compensation payment.

Ensure the Maryland GOCPP updates its CICB Manual to: (1) require that the supporting files for claims contain written justification for any deviation from the CICB's policy on processing decisions, and (2) reflect the applicable and accurate statutory award limits established by the state of Maryland.

Provide specialized training to SecD supervisors and investigators that focuses on recognizing potentially constitutionally protected activity and includes guidance on conducting interviews without unnecessarily intruding into such activity.

Establish clear protocols that require: (a) a heightened approval process for opening SecD investigations of employees with security clearances when these investigations are likely to concern potentially constitutionally protected activity; and (b) notifications within SecD leadership when such investigations are opened.

Implement heightened supervision of SecD investigations of employees with security clearances when these investigations are likely to concern potentially constitutionally protected activity. Consultation with the FBI's Office of General Counsel regarding the propriety of interview questions in such investigations should be part of the heightened supervision process.

Design and implement control activities to review the Accounting Standards Codification No. 2014-09, Revenue from Contracts with Customers (Topic 606) adjustment with sufficient precision to ensure the revenue adjustment is complete and accurate.

Automate their accounting system to recognize revenue under Topic 606 throughout the year.

Design and implement policies and procedures to identify changes in operational activities that necessitate a change in accounting treatment.

Design and implement policies and procedures to identify risks related to presentation matters that are pertinent to the users of the financial statements.

Design and implement a formal revenue recognition review process for significant judgments and elections.

After reviewing a draft of this report, the FBI informed the OIG that FBI leadership had recently decided not to make a policy change at this time that would allow non-attorney supervisors to approve certain U.S. person queries. However, FBI indicated that its decision does not remove the option as a possibility in the future. In light of (1) the FBI's query compliance history described in Chapter One, (2) FBI leadership's initial decision immediately after enactment of RISAA to limit approvals of U.S. person queries to attorneys and the improved level of compliance that followed, and (3) the inherently and highly sensitive nature of conducting U.S. person queries of Section 702-acquired information, prior to allowing selected non-attorney supervisors to approve certain U.S. person queries, the FBI, in consultation with NSD, should conduct an assessment of whether any potential benefits of allowing selected non-attorney supervisors to approve certain U.S. person queries will come at the cost of a decline in the efficacy of the pre-approval requirement, and what additional internal controls can be implemented to prevent such a decline. If the FBI decides to allow non-attorney supervisors to approve certain U.S. person queries, the FBI should further consider starting with a pilot program that emphasizes regularly required training and is subject to monitoring of compliance rates of U.S. person queries approved by non-attorney supervisors and continued oversight.

Regardless of whether RISAA's requirement for the Department to review all FBI U.S. person queries remains in place following that provision's sunset on April 20, 2026, because of the limited resources and capabilities of OIA, NSD should continue its current practice of reviewing 100 percent of the FBI's U.S. person queries.

In light of NSD's continuing independent review of all U.S. person queries and OIA's limited resources, OIA should focus its oversight to complement, rather than duplicate, NSD's work. Under such an approach, OIA's continued reviews of all U.S. person queries could be directed to areas not covered by NSD's reviews, or OIA could use sampling or other GAO-endorsed standards and methods to audit a subset of U.S. person queries with the goal of maintaining the multi-level oversight structure that was contemplated by the 2020 Barr Memorandum Regarding FBI Internal Compliance Functions and that we believe appropriate for these activities.

The FBI should maintain records of all requests to the Deputy Director for approval of sensitive queries and the dispositions of such requests, including requests that are not ultimately approved.

Determine the scope of the pest control problem within the dry-food storage areas at Federal Correctional Institution Terre Haute and address it.

Until permanent repairs planned by the BOP can be completed at Federal Correctional Institution Terre Haute, assess what steps can be taken to mitigate safety and security risks associated with window disrepair and make temporary repairs to the windows that present the greatest potential safety and security risks at the institution.

Strengthen its RRC contractor performance monitoring practices and procedures to ensure that the BOP adequately assesses contractor performance to the specific requirements of the contract and receives the full scope of services it has contracted with providers to deliver.

Work with Kintock to immediately begin providing all classes and services detailed in the contract proposal and ensure it has adequate policies and procedures for documenting its compliance with contract terms and conditions.

Update its standardized IPP form to ensure it adequately addresses all requirements as outlined in the SOW.

Update its standardized RRC contract SOW to include detailed quality standards for the rehabilitation services provided and appropriately defined performance standards.

Update its training of monitoring staff to help ensure the adequacy of its monitoring activities, including IPP evaluations, and other contractor performance quality evaluations.

Ensure contractors are adequately informed of the BOP's expectations of a complete IPP.

Work with Kintock to update its hiring procedures to ensure that only qualified employees are recommended to the BOP for staffing key positions.